Here are four separate anti-spam laws to review. All laws may not apply to your business, so find the ones that do to ensure your email marketing strategy is in line with all the necessary requirements.
CAN-SPAM
Avoid misleading and deceptive language in all parts of the email, including your subject lines.
- Disclose that the email is an ad.
- Provide a clear way for recipients to opt-out of future emails.
- Actually implement those opt-outs and remove them from your email list.
- Monitor any outsourced marketing — your company is still responsible for emails sent on your behalf. That makes it important to hire a reputable agency with a team of email marketing experts who are keeping up with the latest regulatory changes for you.
It’s definitely important to implement these regulations — a violation can cost up to $16,000 for each email sent.
CASL
CASL is the Canadian equivalent of the CAN-SPAM Act, but with some notable differences. The Canadian Anti-Spam Law was created in 2014 but went into full effect in 2016 to reinforce best practices in email marketing and combat spam and related issues. These issues include identity theft, phishing and the spread of malicious software like viruses, worms and trojans (malware).
Here are some of the key ways to be compliant:
- Recipients must opt-in to be added to your email list. It can be implied or explicit consent.
- Implied consent means that you have an existing business or non-business relationship with the individual, such as a previous commercial transaction.
- Consumers who opt out must be removed from your list within 10 days.
There are severe penalties for noncompliance, with costs of up to $10 million. In addition, both criminal and civil charges may be made, and there may be personal liability for company officers and directors.
GDPR
Similar to Canada’s CASL, the European Union’s General Data Protection Regulation (GDPR) started on May 25th, 2018. It covers any messages sent to or received from the European Union and includes regulations on both data security and consent procedures.
Here are some of the key points of compliance surrounding email marketing consent:
- You need explicit consent before sending a commercial email.
- You need consent for the specific email address for the individual, whether personal or corporate.
- You can not use a pre-marked box on your consent forms.
Like Canada, the GDPR imposes hefty fines for non-compliance. A lower-level violation could be the higher of 2% of the company’s revenue or $11.03 million. A higher level violation could be up to the greater of 4% of revenue or $22.07 million. Those are the maximum levels, but those numbers definitely emphasize how seriously the EU views spam violations.
Bottom line: if you’re sending marketing emails to contacts in the EU, you need to make sure that the ways you gather, store, and use that data are compliant. For US-based companies, this often requires changes to their website, email marketing, and sales processes to comply. Because of that, some decide to avoid sending marketing emails to EU contacts altogether.
CCPR (California Consumer Privacy Act)
Companies with a nationwide or regional presence in the U.S. must be aware of the California Consumer Privacy Act. This law secures new privacy rights for California consumers, including the right to know about the personal information a business collects about them and how it is used and shared.
Here are some other CCPR requirements:
- Recipients must have the right to delete personal information collected from them, although there are some exceptions.
- They must have the right to opt out of the sale of their personal information.
- They have the right to non-discrimination for exercising their CCPA rights.
Personal information includes a wide range of data, including name, social security number, purchase history, internet browsing history and more. Check your database for California addresses and make sure these opt-out forms are available for them.